The scathing report by the Centers for Medicare and Medicaid Services is just the latest twist in the Cover Oregon controversy

Both Oracle and Oregon officials bear some blame for the widespread problems with the state's troubled heath insurance exchange website, according to a scathing investigative report on the project that surfaced this week.

The report by the Centers for Medicare and Medicaid Services says Oracle's consulting work on the Cover Oregon site has suffered from an "overall lack of timeliness and quality." In addition, the vendor has been uncommunicative with state officials regarding key project details and uncooperative with other contractors, according to the report.

Oracle has failed to provide the state with comprehensive test results regarding the system's performance and functionality, the report said. The vendor has also given "very little insight" into plans for disaster recovery and continuity.

Instability in the system is affecting development and testing work, and "there is no true development or true test integration environments for developers and testers to properly test their code and test cases respectively," the report adds. "This creates an issue with untested code being introduced into the production environment."

Cover Oregon uses a vast array of Oracle products, which has raised a challenge, according to the report. "While there are other State Based Marketplaces utilizing elements of the Oracle product portfolio, CO has, without doubt, the most complex mix," it states. "As such, there are myriad Oracle technical resources required to maintain and support the system."

Meanwhile, there is also "no evidence" the state has set up a formal, centralized project management office "performing the necessary level of oversight" over Oracle, according to the report, which was obtained by the Oregonian newspaper.

The state "relies heavily on [Oracle] to complete the majority of the day-to-day task and while various individuals own such things as schedules and release plans, there is no single person identified to manage the overall project," it adds.

An Oracle spokeswoman declined comment on Friday. Cover Oregon didn't respond to a request for comment, but its spokesman, Michael Cox told the Oregonian that the report's findings didn't come as a surprise, and that progress has since been made. "The report speaks to the status of where we were in January," Cox said.

Implementation projects are complex and require close cooperation between the client and consulting firm, said Michael Krigsman, CEO of consulting firm Asuret and an expert on the roots of IT project failures. Given what the report describes, "is it any wonder that this project collapsed under its own weight?" he said.

Meanwhile, the fact that the CMMS report was labeled confidential and had to be uncovered by a newspaper "strikes a blow at transparency and should be unacceptable to every taxpayer in the state," Krigsman said.

It's not clear when all of the problems remaining with Cover Oregon, as well as the political firestorm it has generated, will be resolved. Earlier this month, the state said it would withhold US$25.6 million of $69.5 million Oracle says it is owed for project work, and is preserving the right to sue the company.